Cannot favorite (share) items owned by others with shareItemWithGroup as an organizational user

[skitterm]

I want to favorite living atlas content (which is not owned by me) using arcgis-rest-sharing's shareItemWithGroup. I can do so with a public account, but not with an organizational account.

The error I get is:
{"error":{"code":403,"messageCode":"GWM_0003","message":"You do not have permissions to access this resource or perform this operation.","details":[]}}

I am invoking like this, passing the item owner:

shareItemWithGroup({
      id: 'item-id',
      groupId: user.favGroupId,
      authentication: userSession,
      owner: 'owner-of-item',
    })

With public account (it succeeds), the REST request URL is in this format: https://www.arcgis.com/sharing/rest/content/items/item-id/share

With organizational account (it fails), the URL is like this: https://my-org.maps.arcgis.com/sharing/rest/content/users/owner-of-item/items/item-id/share

The token is passed in both requests. I am able to share my own (and members of my organization's) items.

Not sure why /users is being used in some cases and /items in others; could that be why the organizational request is failing?

I can put in a repro case if needed.

[jgravois]

the error you're reporting is limited to scenarios in which an organizational user with admin privileges attempts to update the group sharing of a public item owned by a user in an entirely different org.

arcgis-rest-js/packages/arcgis-rest-sharing/src/group-sharing.ts

Lines 110 to 115 in 8be88a3

	if (owner === username || admin) {
	return `${getPortalUrl(
	requestOptions
	)}/content/users/${owner}/items/${requestOptions.id}/${
	requestOptions.action
	}`;

@dbouwman besides consistency with the docs, is there a tangible benefit to organizational admins using Share item as item owner?

if there is, we could introduce something like outsideOrg: boolean as yet another input parameter, but my instinct is that we're better off just directing org admins to Share item as group admin instead.

[jgravois]

i've proposed a fix in #456 that doesn't alter the public facing API.